4:57 p.m.
Hello,
I was working on the ausearch utility and have it interpreting the logs
nicely. There were a couple issues that popped up where some messages did not
fall into similar patterns. There are several cases where auid does not have
an '=' between it and the loginuid.
Also, I ran into a problem interpreting syscalls because arch comes after the
syscall. Life would be so much easier if arch was before syscall. The
attached patch fixes this. Its against the .46 kernel.
-Steve
3:01 a.m.
On Sun, 2005-05-22 at 17:57 -0400, Steve Grubb wrote:
I was working on the ausearch utility and have it interpreting the
logs
nicely. There were a couple issues that popped up where some messages did not
fall into similar patterns. There are several cases where auid does not have
an '=' between it and the loginuid.
Also, I ran into a problem interpreting syscalls because arch comes after the
syscall. Life would be so much easier if arch was before syscall. The
attached patch fixes this. Its against the .46 kernel.
I can see the point in the former, but I don't see why the latter makes
any difference. Anyway, as far as I'm concerned they're fine, but I'd
like an ack from Kris.
--
dwmw2
11:06 a.m.
On Mon, 23 May 2005 09:01:48 BST, David Woodhouse said:
On Sun, 2005-05-22 at 17:57 -0400, Steve Grubb wrote:
> syscall. Life would be so much easier if arch was before
syscall. The
> attached patch fixes this. Its against the .46 kernel.
I can see the point in the former, but I don't see why the latter makes
any difference. Anyway, as far as I'm concerned they're fine, but I'd
like an ack from Kris.
It allows you to do Perl-ish stuff like this more easily:
($common, $arch, $rest) =~ /(.*)arch=([\S]*)\s(.*)/
if $arch=64bit then // parse $rest with 64 bit pattern
else // parse $rest with 32 bit pattern
If there's arch-dependent values in the $common part, you then need to
re-parse $common as well.
Similar arguments apply for scanf-based parsing - backtracking there is a
pain in the butt....
12:21 p.m.
On Mon, 2005-05-23 at 12:06 -0400, Valdis.Kletnieks(a)vt.edu wrote:
($common, $arch, $rest) =~ /(.*)arch=([\S]*)\s(.*)/
if $arch=64bit then // parse $rest with 64 bit pattern
else // parse $rest with 32 bit pattern
If there's arch-dependent values in the $common part, you then need to
re-parse $common as well.
Yeah, Steve explained. In particular he wants to know the arch before
attempting to parse the syscall number. Kris has said it won't impact
their testing so I'm building it into an audit.48 kernel.
--
dwmw2
3:36 p.m.
On Sun, 2005-05-22 at 17:57 -0400, Steve Grubb wrote:
Also, I ran into a problem interpreting syscalls because arch comes
after the syscall. Life would be so much easier if arch was before
syscall. The attached patch fixes this. Its against the .46 kernel.
I've applied something based on this to the git tree and to the audit.48
kernel. The part which applied to auditfs.c has been merged directly
into linux-2.6.9-auditfs.patch.
--
dwmw2
7153
days inactive
7154
days old
linux-audit@lists.linux-audit.osci.io
4 comments
3 participants
participants (3)
-
David Woodhouse -
Steve Grubb -
Valdis.Kletnieks＠vt.edu